Staying Safe in Web3 | Taylor Monahan - Metamask | Griff Green - Giveth |

[Music] all right hello everyone oh we got some excitement today Griff's coming on the stage already already gets the cheers next up we have a fireside chat staying safe in web 3 with Griff green founder of gith and unicorn. which is providing a safer user experience by giving out ens names attached to secure wallets along with Taylor Monahan security at metamask and probably best known for being uh excellent at the social layer on Twitter thanks thank you uh so today we're going to talk about wallet Safety First for normal users and normal people and then also for high-profile people what do you do and I have like kind of a a maybe a controversial question here because just recently byit was hacked for the largest hack ever 1 point something billion dollars it was more before uh ether tink a little but uh we we we have uh we we actually have hundreds of thousands of users that are perfectly safe after the largest hack ever of a centralized exchang because they're centralized exchange users they're okay right they weren't actually affected now this is my question is it safer to actually be on a centralized exchange a top tier centralized exchange or is it safer to hold a metam Mas key that's for you you work at metamask oh dear um okay they are both insanely dangerous they really are so the difference is whether you want to uh rely on someone else and trust that exchange is going to be fine they're probably not going to be fine they're probably going to get hacked now eventually yeah that's just reality now if it's byit okay bit is an is I think people like in the west don't necessarily understand bit is a massive exchange with massive profits massive liquidity so even though this was like a fantastically huge hack um they actually do have they they are able to cover it um in most other cases that that's yeah you're not able to lose a billion and a half dollars and be okay on the flip side right this is why we're here um the alternative is if you do not rely on a centralized exchange you are relying fully on you but also to a certain extent the products that you're using right and in the case of bit in case anyone was unaware of this so they got hacked by for $1.5 billion um the person or the team team that was compromised was actually not bit though was actually the the safe team um and they directly targeted the bybit cold wallet that was a multisig so that's how that the hack ultimately was executed theoretically um anyone using safe could have been targeted as well and so um I think that at least for me this is basically been my whole life but in the last two weeks us at metamask me as like a security researcher me as a as a person tracking the funds the question is like where is the most risk how do you mitigate that risk as an individual what can we do um and you know with a side of like are we ever going to be able to make it because these threat actors are super serious no exactly and so what do you do like if you're onboarding someone uh that you know that you've never that you know you know not super technical do you send them to a centralized exchange or do you send them to metamask if I'm there in person with them I onboard them to metamask uh I also keep a backup of their seed I would trust you for that for sure uh and then they come back to me in like a year or two when their phone breaks every single time every single time and then I also help them when they come back right I have to help them with their portfolio because they've always just acquired some really nasty coins and we don't want to only be holding those bags so we have to get them back on the right track however if I'm like recommending a you know a person on the internet or someone that I I'm associated with and I'm not going to sit down and like you know help them I'm usually going to recommend them like a coinbase and that's no this is this is my problem too I often just recommend people use coinbase because honestly I don't want the pain of onboarding them but um like I've been doing this for too many years yeah well because it's too hard to stay safe in in crypto you know it there's so many things you have to do there's so many attacks that are possible well and you know coinbase scares me almost more these days I keep having to remind people like by the way don't ever like touch your coinbase anymore right all the people I've on board to coinbase I have to tell them because um we call them the skites they're the little script kitties they're not actual hackers right they're they're kids they'll they'll call pretending to be coinbase customer support insanely popular Vector hundreds of millions of dollars stolen this way they'll basically convince the person that they're hacked but they're not hacked but they convince them that they're hacked and then they convince the person to um let let them fake coinbase support help them at which point they are actually hacked and it's like the number of guys doing this and their success rate is absolutely like absurd and it's not a vector that we had been really I guess you know warning against before I mean it's almost impossible right if someone's just convincing you yeah on you need to spend money somewhere yeah they're English speaking like us UK Canada calls them sounds like a support guy yeah every single time and it's uh yeah but that's that's scary right so what do we as an industry need to do what are the builders in this room how can we build something that normal people can actually on board to web 3 and be protected so I think one thing that's shifted my opinion on the I guess like where the priorities are is that historically I've been a lot more like crypto OG um and I really like I appreciate the TAC I appreciate like being concerned and being like very thoughtful and deliberate with our choices and like sticking our values and like all these really great things um however in order to like really G serious about whether that's like your personal security whether that's your team's operational security whether that's smart contract security whether that's whatever it is right like every single thing you have to execute on it right which means that you have to know what's going on you have to know how they're abusing your product whether that's your team whether that's your users whether that's your literal product and then you actually have to take steps to stop them and the hardest thing the hardest thing for crypto to do right um there's no perfect solution there's not a single feature that we've ever shipped in metamask that will like perfectly solve all of the bad things and it be and it makes it really easy for everyone to sit around and discuss forever whether or not this feature is like good or bad or better could be better right one thing that I've been doing a lot of lately right is uh I just sort I walk into the room and I just remind everyone that the current state of things is like really terrible like we're not doing absolutely nothing it's it's atrocious and so while all the teams are getting into the Weeds on like these really the finer details especially like theoretical problems you know they love talking about theoretical security issues guys we have enough real security issues exactly please please do not go into the theoretical too so I I I have to Shi just for a second because unicorn. eth is like a A system that we're building to basically address all of the normal fishing attacks that I've seen nonprofits suffer on gith okay and so like $100 limit otherwise you need a TFA daily limits smart contract wallets make it so easy and soon 7702 yes will like I'm I'm excited to see what metam Mas does with 7702 dude we have I mean I'm I'm really excited because I feel this is what we've been waiting for for years exactly um and so I feel like it's coming to fruition and they keep by the way they keep coming to me and they go Taylor like what should we be scared of we're not scared enough what should we they're not I am so proud of them for like getting so close to shipping this that I'm like it's great like it's I don't I don't tell me anything it out there Ely they have done they've gone so deep on the experience but also the security and the safety of it that we could like that last like 5 10% we could spend another five years finessing and like double checking and researching it's too late we need to ship it so 70702 by the way allows you to turn an EA into a smart contract type experience so like the things that we do with unicorn where we have $100 daily limits we have if you want to send more than half your money there's an hour time delay uh you know for the coinbase support phone calls uh so at least you have a time to go check with your crypto expert we have uh you know we make it so that you can only connect I don't know that metamask could do this but we actually make it so you can only connect to the apps that have been approved by the Admin yeah so if they click a fishing link nothing happens yeah sir sir that is permissioned technology and you know that is antip so the way we deal with that is it's permissioned in this space but you can go to another website and access permissionless click the fishing link connect to it lose all your money but at least in that you can use metamask yeah exactly you can always withdraw to metamask and click the fishing link but every everyone in eth Denver actually has this wallet embedded in their eth Denver account so we're working to provide safety for the community no I think and I've been a big supporter I think metamask is not and has not been in a position for a variety of reasons to to do something like that to ship it but trust me this is like one of the most talked about things because I mean I really guys I've been doing this for years the onboarding experience is um is atrocious it's so bad it's so bad the worst and the thing is is that even like the least amount of onboarding that you can possibly do is still such a massive amount of information and like really critically important information like they have to like understand things conceptually and then take certain actions and if if they don't pay attention like they're they're gone like they're they're doneo like maybe tomorrow maybe next week maybe next year it'll happen eventually and that's the craziest thing about crypto onboarding in general is that the process is actually like your entire life like your entire crypto experience every single day you're sort of like constantly learning new things and re understanding the concepts and getting safe and getting more secure um and I think that in my opinion like people should have the right to like do whatever they want but most people like don't actually want that like they want to be in a I think I I feel like metamask is like a 747 you know and it just shouldn't be the first vehicle you drive yeah you need a tricycle right onboard people to a tricycle and then eventually they can work themselves up to like a fullon commercial airline yeah we are making improvements though to be clear like we're not metamask is getting a lot better that's for sure but um I do we only have a short amount of time left and I'm curious talk about what what do we so there's you know I'm a I'm a relatively uh high-profile Target we'll say I'm on hundreds of multi sigs I I'm on the security Council for arbitrum I I can you know and I think actually I'm looking in the audience and there's actually a lot of people that fit a description that they could actually be targets how do those people protect themselves you know there's onboarding the masses but then there's the crypto ogs like what do they do what are the best practices so like the highest Roi easiest thing to do dedicated device okay it used to be the cold airor gaaps RI the Wi-Fi card out right it's in ethereum with evm it's not super possible anymore just because you want that extra online data to like tell you what you're signing and to simulate and stuff like that however the risk of your like say daily driver device being compromised is like so high like there's so many different threat groups out there that are trying to get on it they're trying to get you to click links they're trying to get malware on it like low brow info stealer malware it'll steal your crypto Lazarus is out there doing some wild attacks supply chain attacks Etc and so if you're Aigner on something uh and it's like serious right um the best way is you have a separate device keep it offline most of the time don't message on it just don't don't download PDFs on it don't have calls with Venture Capital people on it don't talk to support on it don't go on Twitter or telegram or any like just use it for signing okay um and then the other thing is that uh the mobile experience is getting a lot better iOS meaning like your iPad or your iPhone it's by default at the core like a more sandbox experience it is way more safer like the the sort of like level that th actors have to be that's wild I had no idea yeah because the whole operating system is sort of set up like you can't just run arbitrary code on at the root of an iPhone right yeah so there's still some hiccup okay if you try to sign a multisig with metamask and Nosa safe like okay please open a GitHub issue and we will address it yeah but you know but it's getting a lot it really is getting a lot better and like for me personally I stick to iOS these days because like yeah I'm a very high I'm I'm a very high Prof like they're just always trying to get everying you Taylor I promise uh no but and and one last thing before we go is uh if you do get fit there is a new tool out there called rescue. money that can help you connect you to a white hat that can actually help you capture whatever leftover money is in there and get it back so uh you know it's not all it's it's not all gone if if there's still Assets in there rescue.

money can help you but thank you all for listening and and we'll see you at the next one awesome thank you [Applause]